Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows System' = '"%PROGRAMDATA%\svchost.exe"'
- hidden files
- %PROGRAMDATA%\svchost.exe
- %CommonProgramFiles%\svchost.exe
- %PROGRAMDATA%\svchost.exe
- %CommonProgramFiles%\svchost.exe
- DNS ASK ww##.j03h.com
- '%PROGRAMDATA%\svchost.exe'
- '%CommonProgramFiles%\svchost.exe'
- '%PROGRAMDATA%\svchost.exe' ' (with hidden window)
- '%CommonProgramFiles%\svchost.exe' ' (with hidden window)